|  | 6.2 | ACL Configuration Tasks
| 6.2.2 | The purpose and function of wildcard mask bits

A wildcard mask is a 32-bit quantity that is divided into four octets, with each octet containing 8 bits. A wildcard mask bit 0 means "check the corresponding bit value" and a wildcard mask bit 1 means "do not check (ignore) that corresponding bit value". A wildcard mask is paired with an IP address. The numbers one and zero are used to identify how to treat the corresponding IP address bits. ACLs use wildcard masking to identify a single or multiple addresses for permit or deny tests. The term wildcard masking is a nickname for the ACL mask-bit matching process and comes from of an analogy of a wildcard that matches any other card in a poker game. Although both are 32-bit quantities, wildcard masks and IP subnet masks operate differently. Recall that the zeros and ones in a subnet mask determine the network, subnet, and host portions of the corresponding IP address. The zeros and ones in a wildcard, as just noted, determine whether the corresponding bits in the IP address should be checked or ignored for ACL purposes. As you have learned, the zero and one bits in an ACL wildcard mask cause the ACL to either check or ignore the corresponding bit in the IP address. In the Figure, this wildcard masking process is applied. Say you want to test an IP address for subnets that will be permitted or denied. Assume that the IP address is a Class B address (that is, the first two octets are the network number) with 8 bits of subnetting (the third octet is for subnets). You want to use IP wildcard mask bits to permit all packets from any host in the 172.30.16.0 to 172.30.31.0 subnets. The Figure shows an example of how to use the wildcard mask to do this. To begin, the wildcard mask checks the first two octets (172.30), using corresponding zero bits in the wildcard mask. Because there is no interest in individual host addresses (a host ID does not have .00 at the end of the address), the wildcard mask ignores the final octet, using corresponding one bits in the wildcard mask. In the third octet, the wildcard mask is 15 (00001111), and the IP address is 16 (00010000). The first four zeros in the wildcard mask tell the router to match the first four bits of the IP address (0001). Because the last four bits are ignored, all numbers in the range of 16 (00010000) to 31 (00011111) will match because they begin in the pattern 0001. For the final (least-significant) four bits in this octet, the wildcard mask ignores the value because in these positions, the address value can be binary zero or binary one, and the corresponding wildcard bits are ones. In this example, the address 172.30.16.0 with the wildcard mask 0.0.15.255 matches subnets 172.30.16.0 to 172.30.31.0. The wildcard mask does not match any other subnets.